Skip to content

Latest commit

 

History

History
363 lines (245 loc) · 21.8 KB

CHANGELOG.md

File metadata and controls

363 lines (245 loc) · 21.8 KB

Change Log

v1.5.6 (2016-09-19)

Full Changelog

Fixed bugs:

  • Fix missing symbol handling in aud verify code #166 (excpt)

Merged pull requests:

v1.5.5 (2016-09-16)

Full Changelog

Implemented enhancements:

  • JWT.decode always raises JWT::ExpiredSignature for tokens created with Time objects passed as the exp parameter #148

Fixed bugs:

  • expiration check does not give "Signature has expired" error for the exact time of expiration #157
  • JTI claim broken? #152
  • Audience Claim broken? #151
  • 1.5.3 breaks compatibility with 1.5.2 #133
  • Version 1.5.3 breaks 1.9.3 compatibility, but not documented as such #132
  • Fix: exp claim check #161 (excpt)

Closed issues:

  • Rendering Json Results in JWT::DecodeError #162
  • PHP Libraries #154
  • [security] Signature verified after expiration/sub/iss checks #153
  • Is ruby-jwt thread-safe? #150
  • JWT 1.5.3 #143
  • gem install v 1.5.3 returns error #141
  • Adding a CHANGELOG #140

Merged pull requests:

v1.5.4 (2016-03-24)

Full Changelog

Closed issues:

Merged pull requests:

v1.5.3 (2016-02-24)

Full Changelog

Implemented enhancements:

  • Refactor obsolete code for ruby 1.8 support #120
  • Fix "Rubocop/Metrics/CyclomaticComplexity" issue in lib/jwt.rb #106
  • Fix "Rubocop/Metrics/CyclomaticComplexity" issue in lib/jwt.rb #105
  • Allow a proc to be passed for JTI verification #126 (yahooguntu)
  • Relax restrictions on "jti" claim verification #113 (lwe)

Closed issues:

  • Verifications not functioning in latest release #128
  • Base64 is generating invalid length base64 strings - cross language interop #127
  • Digest::Digest is deprecated; use Digest #119
  • verify_rsa no method 'verify' for class String #115
  • Add a changelog #111

Merged pull requests:

jwt-1.5.2 (2015-10-27)

Full Changelog

Implemented enhancements:

  • Must we specify algorithm when calling decode to avoid vulnerabilities? #107
  • Code review: Rspec test refactoring #85 (excpt)

Fixed bugs:

  • aud verifies if aud is passed in, :sub does not #102
  • iat check does not use leeway so nbf could pass, but iat fail #83

Closed issues:

  • Test ticket from Code Climate #104
  • Test ticket from Code Climate #100
  • Is it possible to decode the payload without validating the signature? #97
  • What is audience? #96
  • Options hash uses both symbols and strings as keys. #95

Merged pull requests:

jwt-1.5.1 (2015-06-22)

Full Changelog

Implemented enhancements:

  • Fix either README or source code #78
  • Validate against draft 20 #38

Fixed bugs:

  • ECDSA signature verification fails for valid tokens #84
  • Shouldn't verification of additional claims, like iss, aud etc. be enforced when in options? #81
  • Fix either README or source code #78
  • decode fails with 'none' algorithm and verify #75

Closed issues:

  • Doc mismatch: uninitialized constant JWT::ExpiredSignature #79
  • TypeError when specifying a wrong algorithm #77
  • jti verification doesn't prevent replays #73

Merged pull requests:

  • Correctly sign ECDSA JWTs #87 (jurriaan)
  • fixed results of decoded tokens in readme #86 (piscolomo)
  • Force verification of "iss" and "aud" claims #82 (lwe)

jwt-1.5.0 (2015-05-09)

Full Changelog

Implemented enhancements:

  • Needs to support asymmetric key signatures over shared secrets #46
  • Implement Elliptic Curve Crypto Signatures #74 (jtdowney)
  • Add an option to verify the signature on decode #71 (javawizard)

Closed issues:

  • Check JWT vulnerability #76

Merged pull requests:

  • Fixed some examples to make them copy-pastable #72 (jer)

jwt-1.4.1 (2015-03-12)

Full Changelog

Fixed bugs:

  • jti verification not working per the spec #68
  • Verify ISS should be off by default #66

Merged pull requests:

  • Fix #66 #68 #69 (excpt)
  • When throwing errors, mention expected/received values #65 (rolodato)

jwt-1.4.0 (2015-03-10)

Full Changelog

Closed issues:

  • The behavior using 'json' differs from 'multi_json' #41

Merged pull requests:

jwt-1.3.0 (2015-02-24)

Full Changelog

Closed issues:

  • Signature Verification to Return Verification Error rather than decode error #57
  • Incorrect readme for leeway #55
  • What is the reason behind stripping the = in base64 encoding? #54
  • Preperations for version 2.x #50
  • Release a new version #47
  • Catch up for ActiveWhatever 4.1.1 series #40

Merged pull requests:

  • raise verification error for signiture verification #58 (punkle)
  • Added support for not before claim verification #56 (punkle)
  • Preperations for version 2.x #49 (excpt)

jwt-1.2.1 (2015-01-22)

Full Changelog

Closed issues:

  • JWT.encode({"exp": 10}, "secret") #52
  • JWT.encode({"exp": 10}, "secret") #51

Merged pull requests:

  • Accept expiration claims as string #53 (yarmand)

jwt-1.2.0 (2014-11-24)

Full Changelog

Closed issues:

  • set token to expire #42

Merged pull requests:

jwt-0.1.13 (2014-05-08)

Full Changelog

Closed issues:

  • yanking of version 0.1.12 causes issues #39
  • Semantic versioning #37
  • Update gem to get latest changes #36

jwt-1.0.0 (2014-05-07)

Full Changelog

Closed issues:

  • API request - JWT::decoded_header() #26

Merged pull requests:

jwt-0.1.11 (2014-01-17)

Full Changelog

Closed issues:

  • url safe encode and decode #28
  • Release #27

Merged pull requests:

jwt-0.1.10 (2014-01-10)

Full Changelog

Closed issues:

  • change to signature of JWT.decode method #14

Merged pull requests:

jwt-0.1.8 (2013-03-14)

Full Changelog

Merged pull requests:

jwt-0.1.7 (2013-03-07)

Full Changelog

Merged pull requests:

  • Catch MultiJson::LoadError and reraise as JWT::DecodeError #16 (rwygand)

jwt-0.1.6 (2013-03-05)

Full Changelog

Merged pull requests:

  • Fixes a theoretical timing attack #15 (mgates)
  • Use StandardError as parent for DecodeError #13 (Oscil8)

jwt-0.1.5 (2012-07-20)

Full Changelog

Closed issues:

  • Unable to specify signature header fields #7

Merged pull requests:

jwt-0.1.4 (2011-11-11)

Full Changelog

Merged pull requests:

jwt-0.1.3 (2011-06-30)

Closed issues:

  • signatures calculated incorrectly (hexdigest instead of digest) #1

Merged pull requests:

* This Change Log was automatically generated by github_changelog_generator